You are right about java. Its a big security/privacy risk. I think its best to have java disabled or uninstalled. Maybe run Noscript addon to block it. I have never seen websites requiring java to order stuff. But some websites are using Flash which might do the same thing.